AWS Security Enhancements and Critical Enterprise Patches

Cloud providers expanded security and performance capabilities while enterprises faced urgent patching across widely deployed platforms. AWS introduced new controls for private console access, policy enforcement for AI agents, and native journald ingestion. At the same time, vendors released fixes for critical vulnerabilities affecting ServiceNow, PaperCut, cPanel, WordPress components, and Gitea. Android 17 added OS-wide encrypted handshakes, and Microsoft detailed a multistage intrusion campaign that establishes a reverse tunnel for lateral movement.

Hardening Console Access and Visibility on AWS

AWS announced general availability of Private Access for the AWS Management Console, enabling organizations to route console sign-in, static assets, console-only APIs, and proxied service API calls entirely over PrivateLink VPC interface endpoints. The approach removes the need for internet gateways or NAT, helping customers preserve strict network egress policies while retaining operational console access. The guidance explains how the console, sign-in, and console-static endpoints integrate with identity and resource controls—such as VPC endpoint policies, resource control policies, resource-based policies, and service control policies—so interactive sessions are governed similarly to programmatic API calls. Configuration notes include enabling private DNS, validating routing and endpoint policies before tightening conditions, and planning break-glass access to avoid lockouts during rollout.

For observability, the CloudWatch agent now natively collects logs from systemd’s journald on Linux, preserving structured fields (for example, unit and priority) and allowing unit-, priority-, and field-based filtering with optional regex before ingestion. In parallel, Amazon Bedrock AgentCore Memory added FGAC, enforced at the infrastructure layer by fronting Memory with an AgentCore Gateway that uses OAuth (JWT) and Cedar policies to isolate per-user and per-tenant data and control 12 Memory operations. Offloading authorization to the gateway reduces application complexity and strengthens multi-tenant isolation.

Compute Throughput and Model Access Expand in AWS

AWS broadened its network-optimized compute with the launch of EC2 C8gn instances in Europe (Paris), bringing Graviton4-based CPUs and sixth-generation Nitro Cards that deliver up to 600 Gbps among network-optimized instances and up to 120 Gbps to Amazon EBS. Sizes scale to 48xlarge with up to 384 GiB memory, and select large sizes support Elastic Fabric Adapter for tightly coupled distributed workloads. Positioning targets network virtual appliances, high-throughput analytics, and CPU-based AI/ML inference where both compute and network performance matter. Separately, AWS expanded availability of P6-B300 instances—featuring eight NVIDIA Blackwell Ultra GPUs, 2.1 TB of GPU memory, and 6.4 Tbps EFA—to additional Regions. Compared with P6-B200, the P6-B300 offers roughly 2x networking bandwidth and 1.5x GPU memory and FP4 TFLOPS, improving training speed and token throughput for large-scale models.

On the AI and data side, SpaceXAI’s Grok 4.6 is now available on Amazon Bedrock in AWS GovCloud (US), offering a 500k-token context window and selectable reasoning effort levels via Bedrock runtime and mantle endpoints with cross-Region inference routing. For databases, Amazon announced general availability of Aurora 3.13 (MySQL 8.0.45-compatible), incorporating upstream fixes and Aurora-specific improvements. Customers can upgrade during maintenance windows, enable automatic minor version upgrades, or orchestrate phased rollouts with AWS Organizations policies, using in-place upgrades or snapshot-based restore strategies.

Critical Fixes for ServiceNow, PaperCut, and Web Platforms

ServiceNow addressed three maximum-severity issues and a high-severity sandbox escape in its AI Platform, as detailed in a ServiceNow flaws roundup: CVE‑2026‑18885 (GraphQL code injection), CVE‑2026‑18886 (improper access control in image upload processing), CVE‑2026‑74820 (SQL injection via a dynamic ORDER BY), and CVE‑2026‑6876 (sandbox escape). The vendor deployed updates to hosted instances and provided patches to partners and self-hosted customers, noting the three CVSS 10.0 issues are low-complexity, pre-auth attack vectors with high impact. As of August 28, the flaws did not appear in CISA’s KEV catalog per the report, and the company said it had no evidence of exploitation.

PaperCut issued a second emergency hardening update after researchers reproduced bypasses of its initial fixes for actively exploited flaws, publishing PaperCut patch advisories for CVE‑2026‑81578 (authentication bypass, 8.8) and CVE‑2026‑82078 (unsafe dynamic class loading, 9.4). Chained, the issues allow attackers to bypass authentication and achieve remote code execution. Release 2 is available for NG/MF versions 24–26 across major OSes; customers on 23 or earlier should upgrade. PaperCut recommends restricting web interface exposure, tightening firewall access, and reviewing systems for indicators such as suspicious PaperCut process activity or altered logs.

Researchers also disclosed multiple high-severity WordPress flaws spanning plugins and a theme that could lead to full site compromise, including: WPMU DEV Dashboard (CVE‑2026‑76581, auth bypass), Avada theme (CVE‑2026‑18431, arbitrary file write that can lead to RCE), TranslatePress (CVE‑2026‑19632, sensitive info exposure), Pods (CVE‑2026‑19598, privilege escalation), and GiveWP (CVE‑2026‑82222, command execution via unsafe unserialization). Site owners are urged to apply vendor patches or mitigations immediately.

cPanel disclosed CVE‑2026‑65643, a cPanel flaw in domain parking and addon domain features that can let an authenticated account create arbitrary files and execute code as root, compromising entire servers. Patched builds were released across supported branches; administrators should update immediately via automated updates or WHM tools.

Shadowserver reported more than 8,300 Internet-facing Gitea servers vulnerable to a critical code injection defect, Gitea RCE (CVE‑2026‑60004), exploitable by actors with repository write access via the diffpatch API. Self-registration defaults may grant attackers the necessary privileges to trigger exploits. Gitea released 1.27.1 on July 27 to remediate the issue; CISA cataloged the bug as actively exploited, directing rapid patching under BOD 26‑04.

Network Privacy and Threat Activity

Google introduced OS-wide support for Encrypted Client Hello in Android 17, encrypting the TLS ClientHello hostname to reduce metadata exposure to on-path observers. Android enables ECH GREASE by default and adds Local Network Protection (permission-gated local network access), turns on Certificate Transparency by default, and offers a carrier opt-in to disable 2G by default to mitigate cellular downgrade and rogue base station risks.

Microsoft detailed a TerminalFix campaign variant that abuses compromised sites to deliver a fake CAPTCHA and social-engineers users into running PowerShell, leading to DLL sideloading, steganography-based payload retrieval, persistent execution, Active Directory reconnaissance, and an encrypted WebSocket reverse tunnel using an embedded Python runtime. The Microsoft report provides indicators of compromise and hunting guidance, urging defenders to treat infected endpoints as potential network pivots.

More than 100 technology and cybersecurity firms issued an open letter warning of a narrowing window to stem AI-enabled cyberattacks. The signatories call for organizations to remediate high-risk exposures, for vendors to integrate AI into defensive tools accessible to critical operators, and for governments and frontier-model providers to strengthen intelligence sharing, incident response partnerships, and responsible model access for critical infrastructure.